A method for cyber attack risk assessment is disclosed. The method uses at least one hardware processor for: continuously collecting, from a networked resource, cyber attack data having multiple attack methods directed at multiple objectives. The method also collects organizational profile data, having: assets, each relevant to at least one of the objectives, and defensive controls, each configured to protect at least one of the assets by resisting one or more of the attack methods. The method continuously computes: an enterprise risk score, and an asset risk score for each of the assets. Each asset risk score is computed with respect to: the attack methods directed at the objectives relevant to the asset, the defensive controls provided to protect the asset, and a maturity score representing the capability of the defensive controls to protect the asset. The method also continuously displays a dynamic rendition of the risk scores.
|
1. A method for cyber attack risk assessment, the method comprising using at least one hardware processor for:
(i) continuously collecting global cyber attack data from a networked resource, wherein the global cyber attack data comprises multiple attacks performed using multiple attack methods directed at multiple attacker objectives;
(ii) collecting organizational profile data, comprising:
(a) multiple assets, each relevant to at least one of the attacker objectives, and
(b) multiple defensive controls, each configured to protect at least one of the assets by resisting one or more of the attack methods; and
(iii) continuously computing multiple cyber attack risk scores, comprising an enterprise cyber attack risk score, and an asset cyber attack risk score for each of the assets, wherein each asset cyber attack risk score is computed with respect to:
(a) the attack methods directed at the attacker objectives relevant to the asset,
(b) the defensive controls provided to protect the asset, and
(c) a control maturity score representing the capability of the defensive controls to protect the asset;
wherein the control maturity score is computed with respect to a control group comprising a set of the defensive controls that protect against a specific one of the attack methods,
wherein the control maturity score is computed as a function of a policy fulfillment level for each of the defensive controls in the control group,
wherein continuously computing multiple cyber attack risk scores further comprises calculating a probability of success parameter (pos) that reflects the capability of a specific one of the attack methods to break through the control groups,
wherein the pos parameter for an attack method is computed as the minimum pos parameter for multiple control groups associated with the attack method, wherein the multiple attacks are implemented by multiple attackers via multiple attack vectors,
wherein each vector includes a set of the multiple attack methods that are required to succeed in the attack,
wherein each vector has a many-to-many relationship with the multiple attack methods, and the multiple attacker objectives,
wherein the multiple attack methods have a many-to-many relationship with the multiple defensive controls, and the multiple control groups, and
wherein the enterprise cyber attack risk score is determined as an aggregation of multiple pos parameters for the multiple attack vectors, the multiple attack objectives and the multiple attackers.
3. A non-transitory computer-readable storage medium (CRM) comprising computer-executable code for cyber attack risk assessment, the code configured to:
(i) continuously collect global cyber attack data from a networked resource, wherein the global cyber attack data comprises multiple attacks performed using multiple attack methods directed at multiple attacker objectives;
(ii) collect organizational profile data, comprising:
(a) multiple assets, each relevant to at least one of the attacker objectives, and
(b) multiple defensive controls, each configured to protect at least one of the assets by resisting one or more of the attack methods; and
(iii) continuously compute multiple cyber attack risk scores, comprising:
(a) an enterprise cyber attack risk score,
(b) an asset cyber attack risk score for each of the assets, wherein each asset cyber attack risk score is computed with respect to:
(i) the attack methods directed at the attacker objectives relevant to the asset,
(ii) the defensive controls provided to protect the asset, and
(iii) a control maturity score representing the capability of the defensive controls to protect the asset;
wherein the control maturity score is computed with respect to a control group comprising a set of the defensive controls that protect against a specific one of the attack methods,
wherein the control maturity score is computed as a function of a policy fulfillment level for each of the defensive controls in the control group,
wherein continuously computing multiple cyber attack risk scores further comprises calculating a probability of success parameter (pos) that reflects the capability of a specific one of the attack methods to break through the control groups,
wherein the pos parameter for an attack method is computed as the minimum pos parameter for multiple control groups associated with the attack method,
wherein the multiple attacks are implemented by multiple attackers via multiple attack vectors;
wherein each vector includes a set of the multiple attack methods that are required to succeed in the attack;
wherein each vector has a many-to-many relationship with the multiple attack methods, and the multiple attacker objectives;
wherein the multiple attack methods have a many-to-many relationship with the multiple defensive controls, and the multiple control groups, and
wherein the enterprise cyber attack risk score is determined as an aggregation of multiple pos parameters for the multiple attack vectors, the multiple attack objectives and the multiple attackers.
7. A system for cyber attack risk assessment, the system comprising:
at least one hardware processor;
a network component; and
a non-transitory computer-readable storage medium comprising computer-executable code for cyber attack risk assessment, the code configured to:
(i) continuously collect, using the network component, global cyber attack data from a networked resource, wherein the global cyber attack data comprises multiple attacks performed using multiple attack methods directed at multiple attacker objectives;
(ii) collect organizational profile data, comprising:
(a) multiple assets, each relevant to at least one of the attacker objectives, and
(b) multiple defensive controls, each configured to protect at least one of the assets by resisting one or more of the attack methods; and
(iii) continuously compute multiple cyber attack risk scores, comprising:
(a) an enterprise cyber attack risk score, and
(b) an asset cyber attack risk score for each of the assets, wherein each asset cyber attack risk score is computed with respect to:
(i) the attack methods directed at the attacker objectives relevant to the asset,
(ii) the defensive controls provided to protect the asset, and
(iii) a control maturity score representing the capability of the defensive controls to protect the asset;
wherein the control maturity score is computed with respect to a control group comprising a set of the defensive controls that protect against a specific one of the attack methods,
wherein the control maturity score is computed as a function of a policy fulfillment level for each of the defensive controls in the control group,
wherein continuously computing multiple cyber attack risk scores further comprises calculating a probability of success parameter (pos) that reflects the capability of a specific one of the attack methods to break through the control groups,
wherein the pos parameter for an attack method is computed as the minimum pos parameter for multiple control groups associated with the attack method, wherein the multiple attacks are implemented by multiple attackers via multiple attack vectors;
wherein each vector includes a set of the multiple attack methods that are required to succeed in the attack,
wherein each vector has a many-to-many relationship with the multiple attack methods, and the multiple attacker objectives, and
wherein the multiple attack methods have a many-to-many relationship with the multiple defensive controls and the multiple control groups, and
wherein the enterprise cyber attack risk score is determined as an aggregation of multiple pos parameters for the multiple attack vectors, the multiple attack objectives and the multiple attackers.
2. The method of
4. The CRM of
5. The CRM of
6. The CRM of
8. The system of
9. The system of
10. The system of
11. The system of
12. The system of
13. The system of
|
The invention relates to the field of cyber defense.
The proliferation of networked computers (e.g. those connected to the Internet) has grown exponentially in recent years. In addition, many local or enterprise networks have connectivity to a network (e.g. the Internet) via a gateway, so that all computers on a business' local network are also accessible to a network (e.g. Internet). Other forms of access, including wireless devices, allowing access to a local or enterprise network, as well as directly to a network (e.g. Internet) are common. In short, network connectivity of computers is quite common.
It is also well known that networked computer may be susceptible to on-line cyber attacks. Such cyber attacks are typically attempts to obtain control or information from the target computer system. A common form of information is data stored pertaining to personal and financial data; however “hackers” or intruders will attempt to obtain any information regarding the target computer system, such as passwords, email addresses, program names, etc. in an attempt to further their illegal goals.
Various companies provide hardware and/or software products for monitoring such attacks, which may record and analyze interactions with a target computer. The vulnerabilities can be determined proactively, such as ‘probing’ computers on a network to determine if they are vulnerable, as well as reactively, such as examining vulnerability after an intrusion has occurred. One class of products is called vulnerability management systems (VMS) and is well known in the area of computer security. The VMS products can scan or monitor a network and report on vulnerabilities associated with the network. VMS products can provide valuable information in the form of reports regarding the vulnerability of a computer on a network
A large business enterprise, which can have tens of thousands of employees working in a country or working in countries across the world, can have thousands of computer systems networked together. Managing the vulnerability of all these computers is a complex task. In some cases, managing the vulnerability of such computers to cyber attacks is done reactively—e.g., only after a computer has been compromised and the compromise detected. Furthermore, the computers can be physically located in various parts of the organization, and for large enterprises, the organization itself can be complex. For many large corporations, there can be numerous subsidiaries and sub-enterprise entities. Indeed, many individuals in a company do not have a complete perspective of the company's organization outside of their immediate workgroup. Consequently, being able to manage computer vulnerabilities for a large enterprise can be very complex and may be carried out on an ad-hoc basis.
Because many large businesses have many networked computers, and because of the frequency of attempts to intrude into their computers, many business have developed computer security organizations whose sole focus is to address such risks and/or cyber attacks. Such personnel require a comprehensive view of the enterprise, both on a human organizational perspective as well as a computer network perspective. In order to address vulnerabilities in the corporate networks, the security people must be able to identify, assess, and react to such threats and vulnerabilities. However, to date, no such tools have been developed to facilitate the management of such problems on a business organization level. Consequently methods and tools for addressing this aspect are required
The following embodiments and aspects thereof are described and illustrated in conjunction with systems, tools and methods which are meant to be exemplary and illustrative, not limiting in scope.
Disclosed herein is a method for cyber attack risk assessment, the method comprising operating at least one hardware processor for: collecting global cyber attack data from a networked resource; collecting organizational profile data from a user, wherein the organizational profile data comprises: types of computerized defensive controls employed by the organization, a maturity of each of the computerized defensive controls, and organizational assets each pertaining to a business environment and each associated with at least one of the computerized defensive controls; and computing a cyber attack risk of the organization in real time, by continuously performing said collecting of global cyber attack data and comparing the global cyber attack data to the organizational profile data, to compute a cyber attack risk score for each of the organizational assets.
In some embodiments, the method may further provide a risk simulator configured to compute an effect of improving one or more of the computerized defensive controls on the cyber attack risk score.
In some embodiments, the risk simulator may be further configured to perform the computing of the effect for each of different ones of the computerized defensive controls, and to compute a tradeoff between improvement of different ones of the computerized defensive controls and the cyber attack risk score.
In some embodiments, the method may further display a dashboard comprising the cyber attack risk score for each of the organizational assets.
In some embodiments, the display of the dashboard may further enable a drill-down into one or more of the organizational assets, to display one or more computerized defensive controls associated with the one or more of the organizational assets.
In some embodiments, the dashboard may comprise a graphical, dynamic gauge for each of the organizational assets.
In some embodiments, the method may further compute a success probability score of one or more attack agents indicated by the global cyber attack data. In some embodiments, the method may further compute a success probability score of one or more attack methods indicated by the global cyber attack data.
Further disclosed is a non-transient computer readable medium having stored thereon instructions that, when executed by at least one hardware processor, may cause the at least one hardware processor to collect global cyber attack data from a networked resource, collect organizational profile data from a user, wherein the organizational profile data comprises types of computerized defensive controls employed by the organization, a maturity of each of the computerized defensive controls and organizational assets each associated with at least one of the computerized defensive controls, and compute a cyber attack risk of the organization in real time, by continuously performing said collecting of global cyber attack data and comparing the global cyber attack data to the organizational profile data, to compute a cyber attack risk score for each of the organizational assets.
In some embodiments, the instruction may further cause the at least one hardware processor to provide a risk simulator configured to compute an effect of improving one or more of the computerized defensive controls on the cyber attack risk score.
In some embodiments, the risk simulator may further configured to perform the computing of the effect for each of different ones of the computerized defensive controls, and to compute a tradeoff between improvement of different ones of the computerized defensive controls and the cyber attack risk score.
In some embodiments, the instruction may further cause the at least one hardware processor to display a dashboard comprising the cyber attack risk score for each of the organizational assets.
In some embodiments, the display of the dashboard may further enable a drill-down into one or more of the organizational assets, to display one or more computerized defensive controls associated with the one or more of the organizational assets.
In some embodiments, the dashboard may comprise a graphical, dynamic gauge for each of the organizational assets.
In some embodiments, the instruction may further cause the at least one hardware processor to compute a success probability score of one or more attack agents indicated by the global cyber attack data.
In some embodiments, the instruction may further cause the at least one hardware processor to compute a success probability score of one or more attack methods indicated by the global cyber attack data.
Further disclosed is a decision support system comprising at least one hardware processor configured to collect global cyber attack data from a networked resource, collect organizational profile data from a user, wherein the organizational profile data comprises types of computerized defensive controls employed by the organization, a maturity of each of the computerized defensive controls and organizational assets each associated with at least one of the computerized defensive controls, compute a cyber attack risk of the organization in real time, by continuously performing said collecting of global cyber attack data and comparing the global cyber attack data to the organizational profile data, to compute a cyber attack risk score for each of the organizational assets, and supporting a decision on improvement of one or more of the computerized defensive controls by providing a risk simulator configured to compute an effect of improving one or more of the computerized defensive controls on the cyber attack risk score.
In some embodiments, the risk simulator may be further configured to perform the computing of the effect for each of different ones of the computerized defensive controls, and to compute a tradeoff between improvement of different ones of the computerized defensive controls and the cyber attack risk score.
In some embodiments, the at least one hardware processor may be further configured to compute a success probability score of one or more attack agents indicated by the global cyber attack data.
In some embodiments, the at least one hardware processor may be further configured to compute a success probability score of one or more attack methods indicated by the global cyber attack data.
In addition to the exemplary aspects and embodiments described above, further aspects and embodiments will become apparent by reference to the figures and by study of the following detailed description.
Exemplary embodiments are illustrated in referenced figures. Dimensions of components and features shown in the figures are generally chosen for convenience and clarity of presentation and are not necessarily shown to scale. The figures are listed below.
A system and a method for cyber attack analyzing, surveying, categorizing, risk assessing, and decision supporting are disclosed herein. The system and method may be highly advantageous to organizations which are threatened by cyber attacks.
The system may include central components which are common and maintained by the system provider, and to local components which holds specific data regarding the certain protected organization. The system may rely on a CCIAS (Central Cyber Intelligence and Analytical Services) which is a set of cyber data best practices, kept in CCIAD (Central Cyber Intelligence and Analytical Data) repository and correspondent software that may allow manipulating this data. CCIAD may keep all analytical models of the cyber data, including maintained environments (controls and assets), maintained threat agents (attackers and attack methods), and maintained list of organization profiles. There may be only one instance of CCIAD. Authorities of the system provider are responsible for keeping this database updated with the latest data and initiating synchronization between CCIAD and LCIAD (Local Cyber Intelligence and Analytical Data) of each customer organization. CCIAD may contain best practices of all maintained data and its maturity.
The present system and method may be better understood with reference to the accompanying figures. Reference is now made to
Organizational data input component may allow entering actual data for actual control scoring. There may be 3 possible sources of input: automatic which is integration with controls, surveys which are questionnaires of one to many people via external survey system, and expert judgment via the system UI (User Interface). In cases when the input on the same control may come from several sources, the system may make its best to resolve conflict of opinions automatically according to following priorities: expert Judgment, automatic input, and survey. In case there are several inputs from survey, the system may choose automatically the worst case opinion. In any case of multiple inputs for single control, the system may send email and set an internal alert for cyber professional(s). Cyber professional may interfere and override automatic opinion selection.
All actions fulfilled by the personas, such as logging into the system, cyber professional override of automatic opinion selection, provisioning and other operations may be registered by the system in the audit log. Each record may contain the date and time (time stamp) of the action, person that fulfilled the action, action description and object(s) that underwent the action.
ORGCIAD may contain local view-only replica of CCIAD, i.e. all data about registered and maintained in the CCIAD threat agents and environments, and customer specific control definitions. Objects which may be synchronized from CCIAD may include assets, controls, maintained attackers and attack methods, maintained organization profiles, calculated attack scores, and all relevant relations between objects above. Each customer may define locally which assets and controls are applicable for its organization, as well as define new assets and controls.
ORGDATA may contain following types of data organizational structure described by the hierarchy of enterprise, systems and environments, enterprise profile which is a definition of the enterprise category as related to cyber attacks probability (enterprise profile definition may use categories of organization profiles kept in CCIAD), ORGCI (Organization Control Implementation) which is an implementation of controls within organizational systems (ORGCI contains control policies with Scoring rules expected in the specific control usage), actual control implementation which is an actual control implementation based on the control cyber status received from organization data input, and actual control implementation history which is the history of all actual control implementations based on the control cyber status received from organization data input.
CDSS may be actually an engine that combines relevant data from ORGCIAD and ORGDATA, calculates actual organization risk assessments and transforms them into the convenient for representation format, allows to simulate various control and attack status scenarios, and transforms results of the simulation into representation format. Upon input from organizational data input layer, the system may automatically match value representing control status to the policy scoring rules, and define an actual maturity level of controls.
The console may serve for management purposes, and usable and intuitive representation of the results provided by the CDSS. CDSS results may be provided in the form of dashboards and/or reports. The system may also be provided for mobile devices.
Reference is now made to
The process methodology unfolds as follows: P1 and P2—may gather internal and external intelligence for the cyber attack landscape and company situation; P3—may calculate probabilities for likelihood of successful attack by relevant attackers, likelihood of successful attack for each environment, likelihood of success of various attack methods, current of maturity of deployed controls, and overall importance of each control in resisting multiple attack methods; P4—may support management decision making with re-assessments for changes in defensive posture or cyber landscape—resource deployment decisions; and P5—may support stakeholder enfranchisement with detailed department situational reports and remediation strategies.
Reference is now made to
The two parties taking part in cyber war are the attackers and the organizations being attacked. For cyber aspects, the organization may be described by enterprises, environments (e.g. web sites, network hardware, software systems, cloud services, etc.), assets, technologies, controls and organizational profile.
Reference is now made to
The assets are the business assets that are undergoing attack (e.g. customers data base, intellectual property, company reputation, etc.). Assets are located in the environments (many-to-many relation). Same asset may appear in many environments. The variety of assets is maintained in the assets Catalog of CIAS and may be modified only by the system provider authorities. Customers may not add their own assets. If a customer requires new asset, he may contact CIAS for appropriate definition.
The technologies define the relevance of an attack vector to the attack objective (e.g. web server, database, operational system, etc.). i.e., if a certain technology is not used in an environment, the attack vectors and objective are not relevant. Technologies reside in the environments (many-to-many relation). Same Technology can appear several times in various environments.
The controls are the business assets that are used to protect assets (e.g. firewall, antivirus, security officer, etc.). Control group is a set of controls used for cyber protect against specific attack method. Control Group can contain one-to-many Controls. Some of the Controls in a specific Control Group, defined in CCIAD, are mandatory for implementation in the organization for successful protection against corresponding attack method. Mandatory Controls will be marked accordingly by the flag.
Organization Profile represents organization profile category that should be taken into consideration during definition of the organization defend ability. The variety of organization profiles treated is defined and initiated in the CCIAD repository. List of treated organization profiles is maintained and can be modified only by the system provider authorities. Organization profile is defined for an enterprise object. Organization profile of the root enterprise object in the specific customer implementation is an aggregation of profiles defined for all child Enterprise object. Organization profiles can be defined by categories: geography, geopolitical, timing, industry sector, etc. Each category can be defined by a set of subcategories.
Attacker may be an individual or an organization or a team of individuals or any other entity that plans and performs cyber attacks on the organizations. Each attacker may implement several applicable attack methods. Any attack method may be used by several attackers (many-to-many relation). The variety of treated attackers may be maintained in the attackers' catalog of CIAS and may be modified only by the system provider authorities. Customers may not add their own attackers.
For cyber aspects, the attacker may be described by skills, resources, and internal accessibility.
The attacker skills may be one of the following: none, minimal, operational or adept.
The attacker resources may be one of the following: individual, team, organization, government.
The attacker internal accessibility may be true (i.e. the attacker may attack internal environments) or false.
Probability of attack may be an assessment based on the gathering of intelligence as to the probability that an attack from this agent may occur. Probability of attack is applicable to organizations via organization profile. It reflects an attacker's motivation to attack specific organization profile, and may be calculated by CIAS, based on previous year trends, events and expert opinion.
Attacker may have several objectives, such as destroy, copy, change, etc. Each objective can be achieved by several attack vectors. Attacker's objectives may have relevancy to specific assets. The variety of treated attacker objectives may be maintained in the attacker objectives catalog of CIAS and may be modified only by the system provider authorities. Customers may not add their own attacker objectives.
Attack vector is a set of mandatory attack methods that have to be fulfilled in order to succeed in the attack. Each attack method in the vector has to be performed one by one. Each attack vector has relevancy (many-to-many relation) to technologies. The variety of treated attack vectors may be maintained in the attack vector catalog of CIAS and may be modified only by the system provider authorities. Customers may not add their own attacker vectors.
Reference is now made to
Attack methods may be a way of how attack is organized by the attacker. Each attacker may implement several applicable attack methods. Any attack Method may be used by several attackers (many-to-many relation). Each attack method may have relevancy (many-to-many relation) to control groups. The variety of treated attack methods may be maintained in the attack methods catalog of CIAS and may be modified only by the system provider authorities. Customers may not add their own attack methods.
The attack method may be described by skills (none, minimal, operational or adept) and resources (individual, team, organization, government). In case skill or resource value of the attacker is less than skill or resource of the attack method, the Attacker may not apply this attack method which, in turn, means that the whole attack vector may not be implemented by attacker.
The organization order of action using the system may be as follows: organization profile categories definition, enterprise and environment trees definition, for each environment define set of assets from CIAS assets catalog, for each environment define set of technologies from CIAS, for each environment mark set of controls from CIAS controls catalog list filtered using the list of attack methods defined, for each selected control provide its actual maturity. Assets, technologies and controls may be defined for each environment.
This may finally yield a hierarchy of enterprises and environments, a list of relevant attackers and objectives, a list of relevant attack methods and attack vectors, a list of actual assets and technologies used in the organization, and a list of actual controls and their groups implemented in the organization.
According to the flow above, list of attackers may be comprised through two not connected paths: via organization profile and via attacker objective and its relation to assets. To avoid ambiguity, it may be assumed that primary list of attackers may be identified by attacker objectives and environment assets.
Reference is now made to
PoA (Probability of Attack) reflects the score of attacker's relevancy for specific enterprise.
POA may be calculated as follows: CCIA (Central Cyber Intelligence and Analysis) Manager may define PoA score in the range of [1-5] for attacker per profile category. Zero (0) level or an absence of the relation between profile category and attacker may mean that the attacker is not relevant for this category. Actual PoA by attacker on the enterprise may be calculated using enterprise—profile category relation, defined in LCIAD. To summarize, attacker→profile category→enterprise path may define relevancy of specific attacker for specific enterprise via its category and is may be translated to PoA.
Control may be defined by description, type, rank, and policies with their weights and set of scoring rules. Control may be represented by hierarchy of controls. Policies are defined only for leaf controls in the tree.
Control Implementation may be an internal control usage within a specific customer enterprise and/or environment. A distinguish between enterprise level control implementation and environment level control implementation may be done. Best practice policies and scoring rules criterions may come from CIAS. Specific control implementation may be defined by the specific internal criterions of the policy scoring rules that, if defined, may override inherited criterions. In other words, customers may override criterions and may also add/delete scoring rules in their implementations. In both levels of control definition, including its policies may be inherited from the ORDCIAD and only criterions may be overridden. Algorithm of choosing relevant criterions for a specific scoring rule may be environment control implementation (if defined), organization control implementation (if defined), and ORGCIAD control definition.
OCM (Optimal Control Maturity) may be control maturity score calculated based on the best practices of CIAS and provided to the customer's ORGCIAD from CCIAD. Usually, it may be 100%.
ECM (Expected Control Maturity) may be control maturity score calculated based on the control implementation in the organization. In case the customer may not override scoring rules recommended by CIAS, ECM may be equal to OCM (which is also the default value).
ACM (Actual Control Maturity) may be the score compliance represents actual compliance to the CIAS and organization specific control policy. Actual control maturity scores may be calculated based on the actual value representing fulfillment of the control policy in the organization. These values are entered to the system via organizational data collecting component.
There are two ACM scores: as related to OCM, defined by CCIAD, and/or as related to organization specific ECM, defined in the organization or on the level of organization or on the level of corresponding environment/system. ACM score as related to CCIAD definitions may be considered to be a main ACM score index.
Control maturity scoring may be a process of calculating control maturity based on the control policies definition. Each leaf control can have a set of policies (many to one relation). For example, firewall rule base has to undergo upgrade, each HR person has to undergo polygraph each 1 month, etc.
Policy may defined by description, weight and set of scoring rules with one of them marked as recommended. Each scoring rule may be defined by a Criterion hat, if achieved, represents specific Level of policy Fulfillment. There may be only one Criterion in a scoring rule. Fulfillment level may be represented by percentage (%) of policy accomplishment. Set of scoring rules can be represented by a table with columns: Criterions and Fulfillment Level (%) sorted ascending by criterions column.
In the following example criterions are shown in italic, and fulfillment levels are shown in bold. Criterion “5” is the recommended one:
Policy: firewall rule base has to undergo upgrades.
Scoring Rules:
Firewall rule base is updated once in 3 months—100%
Firewall rule base is updated once in 5 months—80%
Firewall rule base is updated once in 7 months—50%
Firewall rule base is updated once in 9 months—30%
Firewall rule base is updated rarely than in 12 months—0%
Overachieving of the policy (meaning achieving more than 100% of fulfillment) may be alerted by the system, because it may mean that the organization may waste its effort.
CCIAD and ORGCIAD may contain controls definition maintained by that may include control description (descriptive definition, type and rank), and control policies which may be descriptions+set of policies defined by description, weight, and a set of scoring rules. Policies fulfillment may be defined for a specific control in a specific environment represents control maturity score.
Actual PFL (Policy Fulfillment Level) may be defined for a value representing policy fulfillment of a specific control in a specific system.
Algorithm may be a process of choosing matching scoring rule with a criterion nearest to a value representing policy fulfillment of a specific control. The algorithm may track the set of scoring rules starting from the scoring rule with a maximum criterion and down, find the first scoring rule with criterion equal or less than the value, and if the value is less than the minimal criterion, it may take the best case scoring rule and may alert of overachievement. For the example above, for the value=8, fulfillment level will be 50%. If the value is 5, fulfillment level will be 80%. For the value=2, fulfillment level will be 100% and system should alert on overachievement.
The ACM score may be calculated as a weighted average of all policies' fulfillment levels, i.e. ACM=SUM[WTP1*PFL1/100:WTPn*PFLn/100]*100.
PoS (Probability of Success) may reflect capability of specific attack method to break through applicable CGs (control groups) targeted to resist attacks originated by the attack method.
Reference is now made to
Capability of control to withstand relevant attack methods may be represented by the control maturity score. Attack method can be related to several control groups. Thus, attack method PoS may be an aggregation of the PoS calculated per control group. PoS per one control group may be calculated as a multiplication of weighted maturity scores of all controls in the group. Controls marked as mandatory in the control group may have to be implemented in the organization to achieve accepted protection against specific attack method. WT (WeighT) of specific control in relation to attack method may be defined by CIAC (Cyber Intelligence Analytics Center).
PoS of control group may be calculated as:
PoS(CG)=MUL[(1−WT1*ACM1):(1−WTn*ACMn)]*100%
If the ACM of one of the mandatory controls is <10%, then PoS (CG)=100%
Taking into consideration that people may not give weights normalized to 100%, meaning the SUM of weights won't be 100%. Given weights may rather represent relational weights between controls in the group. Thus, for final calculation all given weights may have to be normalized to 100% as follows:
WT1(norm)=WT1*1/sum[WT1:WTn]
WTn(norm)=WTn*1/sum[WT1:WTn]
For example, there are two controls in the Group with following parameters: Control 1: WT1=0.5 (50%), ACM1=60%; Control 2: WT2=0.2 (20%), ACM2=20%. Normalized to 100% weights will be: WT1(norm)=0.714; WT2(norm)=0.286. And PoS=((1−(0.714*0.6))*(1−(0.286*0.2))*100=(0.571*0.943)*100=0.538*100=53.8%.
If in the certain group a mandatory control is absent, this means that this group's PoS is 100%.
Each AM (Attack Method) may be associated with several CGs (Control Groups). PoS of the AM is calculated as a MN of all PoS of all associated CGs:
PoS(AM)=MN[PoS(CG1):PoS(CGn)]
There might be several attack methods relevant for the set of controls and their groups. Actual PoS may be calculated for all combinations of attack methods verses all related control groups defined in the LCIAD. In case the enterprise is described as a hierarchy of enterprises/environment PoS of attack method is aggregated to the higher levels per attack method type (SQL injection, etc.).
AV (Attack vector) may be a set of AMs (Attack Methods) that may have to be performed one by one to accomplish the attack.
PoS(AV)=MUL[PoS(AM1)/100:PoS(AMn)/100]*100
If one of the AMs in the AV nay not be performed, then PoS of the whole AV may be 0%.
Calculation of the PoS of the attacker objective may be based on the relation between objective and attack vectors required to perform this objective.
PoS(AObj)=MAX[[(PoS(AV1):PoS(AVn)]
Calculation should be performed for all combinations of all objectives⇄attack vectors.
Max possible attacker's PoS may be calculated for each attacker as a MAX of all PoS of its related objectives.
Max PoS(Attacker)=MAX[PoS(AObj1):PoS(AObjn)]
At the enterprise level likely possible attacker's PoS is calculated for each attacker
PoS(attacker)=PoA*MAX PoS(attacker)
Where PoA is Probability of Attack defined by the enterprise organization profile.
Reference is now made to
Aggregation formula may calculate average PoS of all related components, not regarding whether these components are of enterprise, environment or control group types. PoS of the environment may be an average of PoS of all attack methods of all control groups that reside in the environment.
PoS(AM env)=AVG[(PoS(AM1):PoS(AMn)]
PoS of the environment that contains other environment and direct control groups may be an average of the aggregated PoS of sub-environments (PoS (ENV envj)) and PoS of attack methods of all control groups (PoS (AM envi)), all per specific attack method. PoS of the enterprise that contains other enterprises and direct environments may be an average of PoS of all enterprises and all environments that reside in the enterprise, all per specific attack method.
Control Importance may be calculated based on the simulation in two phases: Phase 1—calculating control importance by simulation of changing control maturity by 10% in each round, and notice the aggregated environment/enterprise risk score changing, and Phase 2—calculating control importance by simulation of changing control maturity by 10% in each round per sets of controls, and notice the aggregated environment/enterprise risk score changing.
Sets of controls to be implemented by the organization might be recommended, for the optimal way to protect itself.
In the description and claims of the application, each of the words “comprise” “include” and “have”, and forms thereof, are not necessarily limited to members in a list with which the words may be associated. In addition, where there are inconsistencies between this application and any document incorporated by reference, it is hereby intended that the present application controls.
Patent | Priority | Assignee | Title |
11057774, | May 14 2020 | T-Mobile USA, Inc. | Intelligent GNODEB cybersecurity protection system |
11070982, | Apr 15 2020 | T-Mobile USA, Inc. | Self-cleaning function for a network access node of a network |
11115824, | May 14 2020 | T-Mobile USA, Inc. | 5G cybersecurity protection system |
11170334, | Sep 18 2020 | DEEPWATCH, INC | Systems and methods for security operations maturity assessment |
11206542, | May 14 2020 | T-Mobile USA, Inc. | 5G cybersecurity protection system using personalized signatures |
11316883, | Jul 17 2019 | Bank of America Corporation | Cybersecurity—operational resilience of computer networks |
11316891, | Jul 18 2019 | Bank of America Corporation | Automated real-time multi-dimensional cybersecurity threat modeling |
11336675, | Sep 20 2019 | Bank of America Corporation | Cyber resilience chaos stress testing |
11341236, | Nov 22 2019 | Pure Storage, Inc. | Traffic-based detection of a security threat to a storage system |
11444980, | Apr 15 2020 | T-Mobile USA, Inc. | On-demand wireless device centric security for a 5G wireless network |
11500788, | Nov 22 2019 | Pure Storage, Inc. | Logical address based authorization of operations with respect to a storage system |
11520907, | Nov 22 2019 | Pure Storage, Inc.; PURE STORAGE, INC , A DELAWARE CORPORATION | Storage system snapshot retention based on encrypted data |
11533624, | Apr 15 2020 | T-Mobile USA, Inc. | On-demand security for network resources or nodes, such as for a wireless 5G network |
11556635, | Apr 28 2020 | Bank of America Corporation | System for evaluation and weighting of resource usage activity |
11558747, | May 14 2020 | T-Mobile USA, Inc. | Intelligent cybersecurity protection system, such as for use in 5G networks |
11570198, | Sep 03 2020 | Bank of America Corporation | Detecting and quantifying vulnerabilities in a network system |
11615185, | Nov 22 2019 | Pure Storage, Inc. | Multi-layer security threat detection for a storage system |
11625481, | Nov 22 2019 | Pure Storage, Inc. | Selective throttling of operations potentially related to a security threat to a storage system |
11631042, | Sep 18 2020 | DEEPWATCH, INC | Systems and methods for security operations maturity assessment |
11645162, | Nov 22 2019 | Pure Storage, Inc. | Recovery point determination for data restoration in a storage system |
11651075, | Nov 22 2019 | Pure Storage, Inc.; PURE STORAGE, INC , A DELAWARE CORPORATION | Extensible attack monitoring by a storage system |
11657146, | Nov 22 2019 | Pure Storage, Inc. | Compressibility metric-based detection of a ransomware threat to a storage system |
11657155, | Nov 22 2019 | Pure Storage, Inc | Snapshot delta metric based determination of a possible ransomware attack against data maintained by a storage system |
11659396, | May 14 2020 | T-Mobile USA, Inc. | Intelligent cybersecurity protection system, such as for use in 5G networks |
11675898, | Nov 22 2019 | Pure Storage, Inc. | Recovery dataset management for security threat monitoring |
11687418, | Nov 22 2019 | Pure Storage, Inc. | Automatic generation of recovery plans specific to individual storage elements |
11720691, | Nov 22 2019 | Pure Storage, Inc. | Encryption indicator-based retention of recovery datasets for a storage system |
11720692, | Nov 22 2019 | Pure Storage, Inc. | Hardware token based management of recovery datasets for a storage system |
11720714, | Nov 22 2019 | Pure Storage, Inc. | Inter-I/O relationship based detection of a security threat to a storage system |
11734097, | Jan 18 2018 | Pure Storage, Inc. | Machine learning-based hardware component monitoring |
11755751, | Nov 22 2019 | Pure Storage, Inc. | Modify access restrictions in response to a possible attack against data stored by a storage system |
11799878, | Apr 15 2020 | T-Mobile USA, Inc. | On-demand software-defined security service orchestration for a 5G wireless network |
11811818, | Oct 11 2022 | Second Sight Data Discovery, Inc. | Apparatus and method for determining a risk associated with a cyberattack |
11816223, | Oct 11 2022 | Second Sight Data Discovery, Inc. | Apparatus and method for updating cyber security support based on real-time changes |
11824881, | Apr 15 2020 | T-Mobile USA, Inc. | On-demand security layer for a 5G wireless network |
11824888, | Dec 01 2022 | Second Sight Data Discovery, Inc. | Apparatus and method for assessing security risk for digital resources |
11870799, | Oct 11 2022 | Second Sight Data Discovery, Inc. | Apparatus and method for implementing a recommended cyber-attack security action |
11895141, | Dec 01 2022 | Second Sight Data Discovery, Inc. | Apparatus and method for analyzing organization digital security |
11941116, | Nov 22 2019 | Pure Storage, Inc. | Ransomware-based data protection parameter modification |
Patent | Priority | Assignee | Title |
6301668, | Dec 29 1998 | Cisco Technology, Inc | Method and system for adaptive network security using network vulnerability assessment |
6742128, | Aug 28 2002 | McAfee, Inc | Threat assessment orchestrator system and method |
7383579, | Aug 21 2002 | Kioba Processing, LLC | Systems and methods for determining anti-virus protection status |
7552480, | Apr 23 2002 | Citibank, N.A. | Method and system of assessing risk using a one-dimensional risk assessment model |
7823206, | Jun 01 2000 | Asgent, Inc. | Method and apparatus for establishing a security policy, and method and apparatus of supporting establishment of security policy |
7962960, | Feb 25 2005 | EBATES PERFORMANCE MARKETING, INC DBA RAKUTEN REWARDS | Systems and methods for performing risk analysis |
8161551, | Apr 21 2009 | JPMORGAN CHASE BANK, N A , AS ADMINISTRATIVE AGENT | System, method, and computer program product for enabling communication between security systems |
8726379, | Jul 15 2011 | NORSE NETWORKS, INC | Systems and methods for dynamic protection from electronic attacks |
8739290, | Sep 29 2011 | RSA Security LLC | Generating alerts in event management systems |
9282114, | Jun 30 2011 | EMC IP HOLDING COMPANY LLC | Generation of alerts in an event management system based upon risk |
20020147803, | |||
20030172020, | |||
20040006704, | |||
20040010709, | |||
20040250121, | |||
20050144480, | |||
20060095970, | |||
20060173762, | |||
20060191012, | |||
20060265324, | |||
20060265751, | |||
20070143849, | |||
20070186283, | |||
20080028470, | |||
20080052054, | |||
20080183520, | |||
20080271124, | |||
20080294459, | |||
20090024663, | |||
20090030756, | |||
20090100077, | |||
20090265199, | |||
20100050264, | |||
20100095381, | |||
20100114634, | |||
20100153156, | |||
20100205108, | |||
20100275263, | |||
20110061104, | |||
20110185432, | |||
20110265162, | |||
20120030757, | |||
20120030767, | |||
20120110633, | |||
20120143650, | |||
20120174230, | |||
20120203590, | |||
20120224057, | |||
20120233698, | |||
20130031634, | |||
20130074188, | |||
20130096980, | |||
20130174259, | |||
20130191919, | |||
20130198840, | |||
20140019194, | |||
20140137257, | |||
20160205122, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Jul 13 2016 | ZANDANI, SHAY | CYTEGIC LTD | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 039497 | /0726 | |
Aug 22 2016 | Cytegic Ltd. | (assignment on the face of the patent) | / | |||
Apr 06 2020 | CYTEGIC LTD | SAUL ACQUISITION SUB LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 053104 | /0759 |
Date | Maintenance Fee Events |
Jun 15 2021 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
Sep 15 2021 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Date | Maintenance Schedule |
Mar 27 2021 | 4 years fee payment window open |
Sep 27 2021 | 6 months grace period start (w surcharge) |
Mar 27 2022 | patent expiry (for year 4) |
Mar 27 2024 | 2 years to revive unintentionally abandoned end. (for year 4) |
Mar 27 2025 | 8 years fee payment window open |
Sep 27 2025 | 6 months grace period start (w surcharge) |
Mar 27 2026 | patent expiry (for year 8) |
Mar 27 2028 | 2 years to revive unintentionally abandoned end. (for year 8) |
Mar 27 2029 | 12 years fee payment window open |
Sep 27 2029 | 6 months grace period start (w surcharge) |
Mar 27 2030 | patent expiry (for year 12) |
Mar 27 2032 | 2 years to revive unintentionally abandoned end. (for year 12) |